Build with LookTwice.

REST JSON, Bearer API keys, explicit prices, idempotent charging, and evidence-first responses.

Authentication

Create a key in the Dashboard, copy it once, and send it as a Bearer token. Keys can be scoped, rotated, rate-limited, and revoked.

Validator, CPSC, Knowledge, webhook, usage, key-management and billing scopes are independent. A key-level spend cap covers synchronous charged calls in one UTC calendar month; scheduled Catalog and Knowledge checks use the Workspace balance and do not count against a particular key.

curl https://api.looktwice.dev/v1/credits/balance \
  -H "Authorization: Bearer $LOOKTWICE_API_KEY"

Charged requests are idempotent

Every charged POST requires Idempotency-Key. A retry with the same body returns the original response and never charges twice. Reusing the key with a different body returns 409. Keys are retained for 24 hours. A replay returns Idempotency-Replayed: true, reports zero newly charged credits, and includes the original charge in a separate header.

Live playground

The API key stays in component memory and is sent directly to your configured API origin.

Run a request to see the response.

Email Check · 2 credits

curl https://api.looktwice.dev/v1/email/check \
  -H "Authorization: Bearer $LOOKTWICE_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{"email":"hello@example.com"}'

mailbox_status is always not_checked. LookTwice does not use SMTP probes or claim deliverability.

VAT Check · 1 credit

POST /v1/vat/check
{"country_code":"DE","vat_number":"123456789"}

The response reports current VIES availability and verification time. A VIES outage is a 503 and costs 0.

IBAN Check · 1 credit

POST /v1/iban/check
{"iban":"DE89 3704 0044 0532 0130 00"}

Checks structure and checksum. It does not confirm that the account exists or belongs to a person.

Domain Check · free

POST /v1/domain/check
{"domain":"example.com"}

Returns DNS, MX, TLS and RDAP signals. mx_status distinguishes configured, Null MX, absent and temporarily unavailable mail DNS. Invalid URLs, hosts and subdomains are rejected before quota is reserved. Limit: 100 successful requests per workspace per UTC day.

CPSC Recall Match & Watch

POST /v1/cpsc/recall-match
{"product_name":"GlideFast stroller","brand":"Acme","model":"GF-200"}

Only an exact UPC can produce exact. Brand/model evidence can produce likely; fuzzy text remains possible. none is never a safety clearance.

GET /v1/cpsc/catalogs/{id}/matches
GET /v1/cpsc/catalogs/{id}/matches?status=resolved
GET /v1/cpsc/catalogs/{id}/matches?status=all

Active matches are returned by default. Resolved matches remain auditable, and resolution, risk upgrades and official-notice updates produce distinct events.

Read the product boundary →

Knowledge Watch · 5 credits/check

POST /v1/knowledge/watches
{
  "url":"https://example.com/refunds",
  "facts":[{"key":"refund_period","description":"Refund period"}]
}

V1 accepts public static HTTPS HTML only. It does not log in, render JavaScript, or parse PDF files. Unchanged pages skip AI. Changed pages use structured extraction, but a fact change is saved and notified only when its evidence excerpt appears verbatim in the normalized page text.

Verify webhooks

Compute HMAC-SHA256 with your endpoint secret over timestamp + "." + rawBody, then compare it to X-LookTwice-Signature: v1=…. Reject timestamps older than five minutes.

Deliveries retry after 1 minute, 5 minutes, 30 minutes, 2 hours, 12 hours, and 24 hours. Failed deliveries can be replayed from the API.